Church data protection law constitutes a specific area of data protection law that, in addition to the GDPR is used in practice and is of considerable practical importance to numerous organizations.
With the entry into force of the General Data Protection Regulation (GDPR) In May 2018, even the major churches in Germany had to bring their data protection laws into line with European requirements. To this end, the Evangelical Church in Germany enacted the Church Law on the Data protection the Evangelical Church in Germany (DSG-EKD), while the Catholic Church adopted the Church Data Protection Act (KDG).
The basis for this is Article 91 GDPR. Under this provision, churches and religious organizations may retain their own data protection regulations, provided that these are consistent with the requirements of the GDPR are consistent with.
To whom do the KDG and DSG-EKD apply?
Church data protection laws apply to the Processing processing of personal data by church entities. These include, in particular, dioceses, parishes, regional churches, church corporations, foundations, and other church institutions.
Major charitable organizations such as Caritas and Diakonie, as well as numerous church-affiliated hospitals, long-term care facilities, educational institutions, and social service providers, are also subject to the respective church data protection regulations.
In addition, the regulations may also apply to external service providers. Companies that personal data Those who process data on behalf of church institutions or provide IT services to church organizations must regularly comply with the requirements of the KDG or the DSG-EKD.
Special Features of Church Data Protection Law
Both the KDG and the DSG-EKD are closely modeled on the GDPR. Nevertheless, church data protection laws contain numerous independent provisions and special features.
This applies, for example, to specific requirements for the Processing personal data, the organization of data protection management, employee data protection, and specific procedural rules. Special considerations may also apply when establishing data processing agreements or collaborating with service providers.
Companies should therefore not assume that a GDPR-Compliance This also automatically ensures full compliance with church data protection laws.
Independent Data Protection Oversight by the Churches
A distinctive feature of church data protection law is the churches’ independent data protection oversight structures. Both the Catholic and Protestant churches have their own data protection oversight authorities that monitor compliance with their respective data protection laws.
These supervisory authorities perform duties similar to those of state data protection authorities. They advise church bodies, review complaints, conduct inspections, and may take measures to enforce data protection requirements.
For companies, this means that when collaborating with church-affiliated institutions, church supervisory authorities may also play a role alongside state data protection supervisory authorities, as appropriate.
Practical Implications for Businesses
The practical relevance of church data protection law is often underestimated. In fact, many companies work with church organizations without being aware of the specific data protection requirements. This applies, for example, to software providers, IT service providers, Cloud-Vendors, staffing agencies, payroll processing companies, or external consultants.
Before entering into contracts with church-affiliated organizations, it is therefore important to determine whether the provisions of the KDG or the DSG-EKD apply and what additional requirements result from them. This applies in particular to data processing on behalf of others, the Processing from Employee Data as well as when handling sensitive personal data, such as in the health care or social services sectors.
German 
English 
Italian 
French